Hi,
I searched the interwebs but didn't find definite answer.
We are enrolling clients with ansible like this:
shell: ipa-client-install -U {{ ipa_extra_params }} --domain={{ ipa_domain }}
--principal={{ ipa_admin_user }} --password={{ ipa_admin_password }} --mkhomedir
--force-join --hostname={{ instance_hostname.stdout }}.{{ ipa_domain }}
This works fine.
After enrolling we want to edit the attributes of the newly enrolled host. We do that like
this:
shell: echo {{ ipa_admin_password }} | kinit enroller@{{ ipa_domain|upper }} &&
ipa host-mod --setattr=userclass="{{ host_user_class }}" {{
instance_hostname.stdout }}.{{ ipa_domain }}
This also works fine but we don't love the fact that we echo the password to kinit. I
know that there is the keytab route but that would require moving the keytab file to the
host first. While this is not in any way impossible, we would like to "see all the
cards".
What would be the best practice(tm) for this?